alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Fakelash.A!tr.spy Checkin"; flow:to_server,established; http.uri; content:"/data.php?action="; nocase; content:"&online="; distance:0; content:"&m="; distance:0; content:"&ver="; distance:0; http.user_agent; content:"Dalvik/"; depth:7; reference:md5,7dec1c9174d0f688667f6c34c0fa66c2; reference:url,blog.fortiguard.com/android-malware-distributed-by-malicious-sms-in-france/; classtype:trojan-activity; sid:2016344; rev:5; metadata:affected_product Android, attack_target Mobile_Client, created_at 2013_02_05, deployment Perimeter, signature_severity Major, tag Android, updated_at 2020_10_14, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)